Petr Viktorin (https://github.com/encukou)

tarfile extraction filters allow file modification and content disclosure via hard link to symlink

zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits

Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory

tarfile hardlink fallback ignores custom extraction filter rejection via None

stringprep.map_table_b2() deviates from RFC 3454 Table B.2

tarfile extraction filter bypass allows creation of directories outside the destination

Configuration Injection via Carriage Return (\r) in write() method

tarfile extraction filter bypass allows escaping the destination directory

tarfile opened in streaming mode mishandles EOF

Potential DoS via quadratic complexity in unicodedata.normalize()